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Field of the invention 

[0001] This invention relates to the protection of 
intrinsically safe circuits, which are potentially incendive . 
It is particularly concerned with the protection of 
5 intrinsically safe circuits which operate within hazardous 
areas, for example in the presence of flammable gases. 
Background of the invention 

[0002] In systems where power supplies feed a number of 

functional modules, where there may be the presence of 

10 flammable gases, there is a need to ensure that the system is 
safe. This means that the wiring between the power supplies 
and the modules must be protected in some way so that it is 
not incendive, even if the modules are unplugged with the 
system running. One way to achieve this is to provide 

15 electronic power limiters in the output from each of the power 
supplies. These power limiters define the maximum output 
voltage and limit the short-circuit current. However, these 
power limiters are quite complex because they must meet the 
conflicting requirements of being precise yet operate fast. 

2 0 This complexity has to be duplicated to meet the requirements 
of other, more exacting systems. 
Summary of the invention 

[0003] It is an object of the present invention to provide 
a means of protecting potentially incendive, intrinsically 
25 safe circuits using a simpler system than the relatively 
complex, conventional power limiters. 

[0004] It is a further object of the invention to provide 

means whereby one affords complete protection to the wiring 
and to any plugs and sockets along the way. Desirably, 
30 provided that the inductance and capacitance limits are not 
exceeded, the wiring from the power supply to the modules is 
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protected from open-circuit and short-circuit faults, so that 
no special construction is required. 

[0005] In equipment or assemblies in which the wiring is 
well -controlled, the segregation between conductors can be 
5 controlled in the construction of the circuitry. If this 
segregation is made infallible, then short-circuit faults need 
not be considered and one only needs to protect against series 
breaks. For this, simpler protection schemes are adequate. 
[0006] If one is concerned only with series breaks, then 

10 this removes the constraint to put the electronic protection 
upstream from the wiring to be protected. It simply has to 
be somewhere in series with the intrinsically safe circuit. 
The importance of this to achieving protection in accordance 
with the invention will be apparent from the description given 

15 hereinafter. 

[0007] In accordance with the invention there is provided 

a method of protecting intrinsically safe circuits in which 
a voltage is supplied via a supply circuit to a load, which 
comprises sensing the voltage at the load and, in the event 

2 0 that a decrease in the said voltage is detected, disconnecting 

the load in such manner as to prevent any series break in the 
supply circuit from becoming incendive. 

[0008] Also in accordance with the invention there is 
provided apparatus for protecting an intrinsically safe 
25 circuit which includes a load and which is arranged to be 
supplied via a supply circuit with a voltage from power supply 
means, the apparatus comprising sensing means arranged to 
detect the said voltage, and switch means arranged, in 
response to the detection by the sensing means of a decrease 

3 0 in the said voltage, to disconnect the load in such manner as 

to prevent any series break in the supply circuit from 
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becoming incendive . 

[0009] Also in accordance with the invention there is 
provided a power system for an intrinsically safe circuit, 
comprising power supply means, power distribution means 
5 connected to the power supply means, and at least one module 
connected to the power distribution means, the or each module 
comprising an intrinsically safe circuit including a load, 
sensing means to detect the voltage suppled to the load, and 
switch means arranged, in response to the detection by the 
10 sensing means of a decrease in the supplied voltage, to 
disconnect the load in such manner as to prevent any series 
break upstream from the switch means from becoming incendive . 
Brief description of the drawings 

[0 010] In order that the invention may be more fully 
15 understood, a number of protection systems in accordance with 
the invention will now be described by way of example and with 
reference to the accompanying drawings . In the drawings : 
[0 011] Fig. 1 shows a known example of the use of an active 
voltage and current limiter to protect against wiring shorts 
2 0 and breaks; 

[0012] Fig. 2 illustrates the concept underlying the 
present invention, in which the voltage and current which is 
sensed upon a break in the wiring opens a switch; 

[0013] Fig. 3 is a circuit diagram showing a first 
2 5 embodiment in accordance with the invention; 

[0 014] Fig. 4 shows a second embodiment in accordance with 

the invention using a transistor switch; 

[0015] Fig. 5 shows a third embodiment in accordance with 
the invention; 

30 [0016] Fig. 6 shows a bussed power system in accordance 

with the invention; 
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[0017] Fig. 7 shows a single-stage detection/switching 
circuit for use in a system in accordance with the invention; 
[0018] Fig. 8 shows a circuit used to assist in starting 
up of the system; and, 
5 [0019] Fig. 9 shows how the circuit of Fig. 7 is duplicated 

in a cascade arrangement . 

Description of the preferred embodiments 

[002 0] The circuit shown in Fig. 1, to illustrate the prior 
art, has a voltage supply 10, a load 12 and an active voltage 

10 and current limiter 14 upstream from the load. A pin 16 
illustrates a short-circuit condition and a break in the 
wiring is indicated at 18. The active limiter 14 shown in 
Fig. 1 protects the load by limiting the voltage and current 
which is available to the circuit and keeping the values below 

15 a known incendive limit. However, this is not strictly 
necessary. What is required is to restrict the voltage and 
current which is available to a developing spark to levels 
below the incendive limit. 

[0021] Fig. 2 illustrates the concept underlying the 

20 present invention. Al is a voltage sensor, sensing the 
voltage developed across the break 18 in the circuit. A2 is 
a current sensor, sensing the current flowing through it. The 
two sensors Al and A2 are combined in a manner which will 
enable a switch 20 to open before the V/I characteristic 
25 exceeds the incendive limit. It is to be noted that the power 
available to the load 12 is not now constrained to be below 
the incendive limit. 

[0022] It is also to be noted that the circuit shown in 

Fig. 2 merely illustrates the concept underlying the present 
3 0 invention. In particular, only the wiring between the inputs 
of voltage sensor Al is protected. 
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[0023] Fig. 3 shows a first embodiment in accordance with 

the invention in which all of the circuit to the left-hand 
side of the voltage sensor Al is now protected. Voltage 
sensor Al now senses the voltage at the load end of the 
5 circuit, protecting all the wiring to its left. The voltage 
supply 10 is now added to the voltage sensed by voltage sensor 
Al, but is constant and allowance can be made for it. More 
importantly, the current sensor A2 is omitted and the output 
of the voltage sensor Al is taken directly to the switch 20. 

10 It is known that for hydrogen, the most incendive gas group, 
it is impossible to get ignition with a voltage which is less 
than about 8 volts at any current, provided that the current 
is insufficient to cause hot or molten metallic particles to 
be thrown off from the sparking contact. If the voltage which 

15 is allowed to develop across a breaking contact is restricted 
to less than 8 volts, then a precise current limit may not be 
required. In some apparatus, it may be possible to rely on 
the nature of the load 12 to determine the maximum current . 
[0024] The circuit shown in Fig. 3 will only be effective 

20 if the voltage sensor Al and the switch 20 are sufficiently 
fast. Experience in the use of active limiters suggests that 
the protection must operate within a few microseconds. 
Research has been reported which suggests that the minimum 
spark duration capable of causing ignition is around 8/j.s. A 

25 transistor operating in a common-base configuration can be 
much faster than this and can be configured in a simple 
circuit which combines both the sensing and switching 
functions. Fig. 4 shows this in outline. 

[0025] In Fig. 4 which shows a common-base transistor 

30 switch 20, a zener diode Zl is connected to the base of the 
transistor. The voltage of zener diode Zl is selected so 
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that, when the circuit is unbroken, the supply voltage is 
present at the emitter of the switch 2 0 and base current is 
drawn through the zener diode Zl . The transistor switch 2 0 
is turned hard on and current is fed to the load 12. If a 
5 break occurs, as indicated at 18, voltage is dropped across 
the break as a spark develops, resulting in the emitter 
voltage of the transistor 20 dropping. At a predetermined 
point, when the emitter voltage drops below the zener voltage, 
plus the emitter-base drop, the transistor 20 will turn off 

10 and disconnect the load 12. 

[002 6] Fig. 5 shows a third embodiment of the invention 

which embodies these principles. For clarity, and to improve 
the understanding of the invention, the power supply, the 
wiring/power distribution, and the module which incorporates 

15 both the load and the disconnection switch are indicated 
separately by the broken vertical lines. Plug connections 19 
indicate that the parts of the system can be unplugged to 
cause a circuit break. A series diode Dl is connected between 
the emitter of transistor TRl and the power supply 10. A 

2 0 resistance Rl is connected between the base of the transistor 

TRl and a zener diode D2 . A second resistance may be 
connected between the emitter and base of the transistor TRl . 
The resistance Rl limits the base current through transistor 
TRl to about 15 mA. 
25 [0027] If a break occurs to the left of TRl, D2 and Rl, due 

either to a fault or a deliberate unplugging, the voltage at 
the emitter drops as voltage is developed across the break. 
The voltage of Zener diode D2 is chosen so that transistor TRl 
turns off before the spark has developed sufficient energy to 

3 0 be incendive. This basic circuit has been tested at 24V, 0 . 9A 

and found to be non- incendive in hydrogen/air with a Zener 
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diode voltage as low as lOV. 

[0028] In one practical test circuit to this design, a load 

of 26 ohms was used, giving a load current of about 850mA, 
which is normally incendive in a constant current circuit down 
5 to around 12 volts or so. 

[0029] The circuit was spark ignition tested according to 

EN 50020, using the 21% hydrogen in air explosive test mixture 
specified for group IIC gases. During this test, the power 
supply voltage was held constant at 24V, while the voltage of 
10 the Zener diode D2 was progressively reduced until ignition 
occurred. At the same time, resistor Rl was adjusted to 
maintain the current through Zener diode D2 to about 15mA. 
The effect of reducing the Zener diode voltage in this way was 
to increase the voltage across the spark before transistor TRl 
15 turns off. 

[003 0] There were no ignitions until the spark voltage 
exceeded about 12V, demonstrating that the circuit does 
provide the expected protection. 

[0031] The construction of the wiring between the power 

2 0 supply and the module is controlled so that shunt faults 

cannot occur. Series faults (breaks) are rendered non- 
incendive by the protection provided by the switch. 

[0032] The power supply connection is protected just as is 

the module connection, so both the power supply and the module 
25 can be safely disconnected under power. 

[0033] The circuitry to the right of transistor TRl is not 

protected and so will be designed to be non- incendive using 
other techniques. 

[0034] This protective circuit in accordance with the 

3 0 invention is very simple, inherently fast, and can be easily 

cascaded . 
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[0035] Fig- 6 shows a bussed power system where one or more 

power supplies 10a, 10b (here two) are feeding a number of 
modules (here three) fitted to a backplane or power bus 30. 
The modules are shown with loads 12a, 12b, 12c. 
5 [0036] The protection works equally well with multiple 
modules as with a single module. The effect of a break at a 
common point feeding several modules is equivalent to a break 
feeding a single module taking the same total current . 
a) If a power supply 10a, 10b is disconnected, and the 
10 remaining power supply or supplies are able to maintain 

the bus voltage, then no spark will be developed at the 
break because no voltage will develop across it. This 
is so even without the switch protection of the present 
invention . 

15 b) If a power supply 10a, 10b is disconnected and the bus 
voltage falls, a spark will develop at the break and the 
protection system of the invention will function to 
prevent it becoming incendive . 
[0037] The circuits described above are not tolerant of 

2 0 component faults, but are suitable for use in environments in 

which the flammable gas hazard is less severe. For Zone 1 
environments, additional requirements are imposed. These 
include : 

a) The circuitry to the right of TRl, D2 and Rl is 
25 unprotected by the switch and so the construction must 

protect any potentially incendive currents in some other 
way. Full encapsulation is one possibility, but is 
rather inelegant. Alternatively, the current -carrying 
tracks could be made infallible up to the point where the 

3 0 circuitry branches and the current in each branch is 

limited by other means. 



b) Each component on which intrinsic safety depends, which 
is most of them, must be run at two-thirds of its 
manufacturer's rating under all conditions of operation. 
(Unless a countable fault in a neighbouring component has 

5 occurred and the first component is no longer relied upon 

for intrinsic safety protection) . 

c) Protection must be maintained with one fault. Two 
switching circuits will be needed in cascade to achieve 
this. 

10 [0038] Fig. 7 shows a single-stage detect ion/switching 
circuit for use in accordance with the invention. Being 
single-stage it has no fault tolerance, but it is easier to 
consider than a two- stage implementation. 

[0039] The following target specification assumes a 24V 
15 system, each module drawing up to 0.5A. 24V is a convenient 
supply voltage in many systems and it allows lower currents 
to be used, allowing more modules per bus for a given 
available bus current, and reduced voltage drops. 

[0040] Target Specification 

20 

Supply voltage range 23V to 24V 

Supply voltage safety limit 26V 
Load voltage range 21V to 24V 

Minimum available load power lOW 
25 Minimum available load current 0 . 5A 

Input cut-off voltage 20V 



[0041] ^Load' means the module circuitry which is fed by 

the protection circuit. 
3 0 [0 042] The input cut-off voltage is the minimum voltage at 

which the protection is guaranteed to operate. 
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[0 043] Transistor TRl and Zener diode D2 are the transistor 

and Zener diode as in Fig. 5. The remainder of the circuit 
essentially protects transistor TRl from over-current and 
over-dissipation . 

5 

[0044] Transistors TR3 and TR4 act as a comparator, 

monitoring the sum of transistor TRl ' s Vce and the volt drop 
across a current sense resistor R5 . A substantially constant 
reference voltage is generated across resistor R2 by the 

10 current drawn through resistor R2 , transistor TR3 , and 
resistor R3 . In normal operation the emitter voltage of 
transistor TR4 is higher than that of transistor TR3 so 
transistor TR4 is switched on and the base voltage of 
transistor TR2 is set by the divider action of resistors R7 

15 and R8 from the output voltage Vout . 

[0045] Transistor TR2 and resistor Rl define the current 

through Zener diode D2 and the base of transistor TRl; about 
5mA for example. The Zener current in this circuit is more 
nearly constant compared to that in Fig. 5. Each of resistor 

2 0 Rl, transistor TR2 , and diode D2 can be rated to withstand a 
short-circuit fault in either transistor TR2 or diode D2 . 
[0046] If the total voltage developed across transistor TRl 
and current -limit sense resistor R5 exceeds the reference 
voltage across resistor R2, then transistor TR4 and transistor 

25 TR2 turn off, turning off transistor TRl to protect it from 
over-current or over-dissipation. 

[0047] Once transistor TR4 is switched off, the circuit is 

latched with transistor TRl off and Vout=0. Resistor R4 
provides sufficient current to allow the circuit to restart, 
30 provided there is no significant load current until transistor 
TRl is switched on. 
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[0048] Input diode Dl ensures that no backfeed is possible 
from energy stored in the load. It also unambiguously 
protects the base-emitter junction of transistor TRl from 
reverse bias, which could occur under transient conditions. 

5 

[0049] Diode D3 protects the base-emitter junction of 

transistor TR4 from reverse bias when Vout is low. Resistor 
R6 restricts the current drawn from Vin through resistor R2 
and diode D3 . 

10 [0050] CI is a Miller capacitor to slow down the operation 

of transistors TR4 and TR3 to afford some immunity to 
transients. The current limit defined by resistor R5 is not 
to prevent sparking. It is primarily rating protection for 
transistor TRl and so need be no faster than a fuse. This 

15 current limit also defines the maximum load current that the 
module can demand. It is closer protection than would be 
afforded by a fuse and thus benefits the design of the module 
circuitry for thermal safety. 

[0051] An advantage of this circuit is that it protects 

20 transistor TRl both against over-current and against over- 
dissipation. When Vin is healthy, transistor TRl is hard on 
and dissipating very little. When Vin drops, transistor TRl 
rapidly switches off and dissipates zero power. 
[0052] The start-up of the system needs to be considered. 

25 Resistor R4 bleeds sufficient current into Vout to ensure 
start-up of the protection circuit. This current is kept as 
low as possible by running transistor TR3 and transistor TR4 
at a relatively low collector current, 0.2mA, so that resistor 
R4 is as large as possible. For the safety assessment, it is 
3 0 assumed that the load short-circuits Vout to OV, so resistor 
R4 appears across Vin to OV and the current through it is not 
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switched by transistor TRl . Each module connected to a common 
bus would be assumed to draw that current and so the total 
current would depend on the number of modules. This total 
current has to be considerably less than the short-circuit 
5 current allowed by the resistive curves if it is not to 
compromise the spark protection of the system; 143mA is the 
limit at 26 V. 

[0 053] However, resistor R4 cannot provide enough current 

for start-up with the load connected, so the load must be 

10 switched in after start-up. Fig. 8 shows one way of doing 
this. Transistor TR5 senses the voltage across resistor Rl 
and provides an open-collector signal to an inhibit line on 
a power converter following. The threshold is set so that 
transistor TR5 switches on when adequate base current is being 

15 drawn from transistor TRl to be certain that it is switched 
hard on. 

[0054] Fig. 9 shows how the circuit of Fig. 7 can be 

duplicated to provide one- fault safe protection for use in 
more severe environments. Two Fig. 7 circuits are essentially 

20 cascaded but there is a single current-sense resistor R5 . The 
components in the ''second" circuit which correspond to those 
in Fig. 7 are indicated by the same references with an added 
dash. Each of the two dissipation and over-current 
comparators senses the sum of the collector-emitter voltages 

25 of the two switching transistors TRl, TRl', and the IR drop 
in the current-sense resistor R5 . Hence over-dissipation in 
either switching transistor, or over-current, causes both TRl 
and TRl' to be turned off. The circuit is therefore safe with 
any single countable fault. 

30 [00551 The protection system of the present invention has 
a number of advantages over known forms of protection. 
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i) As compared to expensive power supply limiters, the 
present invention requires only the addition of 
inexpensive components to the modules. They 
dissipate little power, even under fault 

5 conditions, so there is no great demand for the use 

of heat sinks . 

ii) The power supplies are simple. Multiple modules 
can be fed through a bus system. No output current 
protection is necessary since the switching 

10 circuitry in the modules limits the total current 

that can be drawn. 

iii) The protection system protects all the power 
systems upstream from the module against series 
breaks, both from faults and unplugging, including 

15 the power supply connections, so no special 

measures are required to protect the power bus 
against series breaks . 

iv) Power is not restricted to non-incendive levels. 

v) There is no disadvantage in using higher supply 
20 voltages. In fact, efficiency and available power 

increases at higher voltages . 

vi) The only protection required in the power supplies 
is to limit the output voltage. 

[0056] While the present invention has been described with 
25 reference to particular embodiments, those skilled in the art 
will recognise that many changes may be made thereto without 
departing from the spirit and scope of the present invention. 



